Junglewise Threat Intelligence

CVE-2024-57929: Linux Kernel dm-array double release in dm_array_cursor_end

CVE-2024-57929 · Severity: high · CVSS 7.1 · Published 2025-01-19

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's Device Mapper component could allow a local user to cause a system crash or potentially access sensitive information. The issue occurs when the system handles corrupted storage metadata, leading to a 'double release' error that halts the operating system. This affects systems using specific storage configurations like dm-cache or dm-array.

Technical details

A double-free vulnerability (CWE-672) exists in the dm-array component of the Linux kernel. When dm_bm_read_lock() encounters a locking or checksum error, it implicitly releases the block but leaves an invalid pointer in the output parameter. The dm_array_cursor incorrectly caches this invalid pointer, leading to a second release attempt in dm_array_cursor_end(). This triggers a BUG_ON in the dm-bufio cache_put() function. An attacker with local privileges could exploit this by providing specially crafted or corrupted storage metadata to trigger a kernel crash. The fix ensures the cached block pointer is set to NULL upon encountering errors.

Affected products

  • Linux Linux Kernel 4.9 to 5.4.290, 5.5 to 5.10.234, 5.11 to 5.15.177, 5.16 to 6.1.125, 6.2 to 6.6.72, 6.7 to 6.12.10, 6.13-rc1 to 6.13-rc6

Timeline

  • 2024-12-05: other: Patch authored
  • 2025-01-17: patched: Patch committed to stable branches
  • 2025-01-19: advisory: CVE published

References

Related threats